---
typeId: req
recordId: benac-sec-006
fields:
  title: Raw secrets prohibited outside protected secret handling
  statement: Raw secret material shall not be exposed to package code through
    package documents, descriptor documents, invocation requests, host-local
    metadata, operational envelopes, package bundles, replicated documents,
    evidence records, effect records, logs, or agent-readable inspection APIs
    unless an explicit high-risk secret-disclosure profile permits the exposure
    and records it. Secret references may be package-visible where authorized.
    Raw secret values shall be mediated by the Host Station and stored in
    protected storage or an equivalent local vault mechanism.
  rationale: A field is not safe merely because it is outside package identity.
    Raw secrets can leak through package input, replication, export, logs,
    evidence, effects, or UI inspection unless explicitly prohibited and
    redacted.
  verification: Fixtures place token-like values in package documents,
    descriptors, operational metadata, evidence records, effect records, and
    package bundles. Baseline hosts reject, redact, omit, encrypt, or mark the
    material non-exportable according to policy. A package requiring API
    authentication receives only a secret reference or host-mediated
    authenticated operation, not the raw secret.
  area: BENAC-SEC
  sourceSections:
    - 10.13 Secrets, protected local state, and redaction
  order: 152.5
  testable: true
  status: draft
  sourceDocument: user-requested requirements cleanup
  sourceVersion: DRISL terminology cleanup pass
---
